[PR] avfilter/vf_xfade: fix out of bounds reads at the transition endpoints (PR #24165)
michaelni via ffmpeg-devel <[email protected]>
| Newsgroups | gmane.comp.video.ffmpeg.devel |
|---|---|
| Message-ID | <178681119240.59.586117816148161179@29965ddac10e> |
PR #24165 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24165 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24165.patch Fixes: #22273 Fixes: #21622 >From 3fe03e0721193bb1f32c054e85028521f4971562 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sat, 15 Aug 2026 14:01:55 +0200 Subject: [PATCH] avfilter/vf_xfade: fix out of bounds reads at the transition endpoints Fixes: #22273 Fixes: #21622 --- libavfilter/vf_xfade.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/libavfilter/vf_xfade.c b/libavfilter/vf_xfade.c index 53dcf3e1e5..f26d3865b8 100644 --- a/libavfilter/vf_xfade.c +++ b/libavfilter/vf_xfade.c @@ -469,7 +469,7 @@ static void slideleft##name##_transition(AVFilterContext *ctx, for (int y = 0; y < height; y++) { \ for (int x = 0; x < width; x++) { \ const int zx = z + x; \ - const int zz = zx % width + width * (zx < 0); \ + const int zz = (zx + width) % width; \ dst[x] = (zx >= 0) && (zx < width) ? xf1[zz] : xf0[zz]; \ } \ \ @@ -502,7 +502,7 @@ static void slideright##name##_transition(AVFilterContext *ctx, for (int y = 0; y < height; y++) { \ for (int x = 0; x < width; x++) { \ const int zx = z + x; \ - const int zz = zx % width + width * (zx < 0); \ + const int zz = (zx + width) % width; \ dst[x] = (zx >= 0) && (zx < width) ? xf1[zz] : xf0[zz]; \ } \ \ @@ -532,7 +532,7 @@ static void slideup##name##_transition(AVFilterContext *ctx, \ for (int y = slice_start; y < slice_end; y++) { \ const int zy = z + y; \ - const int zz = zy % height + height * (zy < 0); \ + const int zz = (zy + height) % height; \ const type *xf0 = (const type *)(a->data[p] + zz * a->linesize[p]); \ const type *xf1 = (const type *)(b->data[p] + zz * b->linesize[p]); \ \ @@ -564,7 +564,7 @@ static void slidedown##name##_transition(AVFilterContext *ctx, \ for (int y = slice_start; y < slice_end; y++) { \ const int zy = z + y; \ - const int zz = zy % height + height * (zy < 0); \ + const int zz = (zy + height) % height; \ const type *xf0 = (const type *)(a->data[p] + zz * a->linesize[p]); \ const type *xf1 = (const type *)(b->data[p] + zz * b->linesize[p]); \ \ @@ -1633,7 +1633,7 @@ static void squeezeh##name##_transition(AVFilterContext *ctx, for (int y = 0; y < height; y++) { \ const float z = .5f + ((slice_start + y) / h - .5f) / progress; \ \ - if (z < 0.f || z > 1.f) { \ + if (progress <= 0.f || z < 0.f || z > 1.f) { \ for (int x = 0; x < width; x++) \ dst[x] = xf1[x]; \ } else { \ @@ -1673,7 +1673,7 @@ static void squeezev##name##_transition(AVFilterContext *ctx, for (int x = 0; x < width; x++) { \ const float z = .5f + (x / w - .5f) / progress; \ \ - if (z < 0.f || z > 1.f) { \ + if (progress <= 0.f || z < 0.f || z > 1.f) { \ dst[x] = xf1[x]; \ } else { \ const int xx = lrintf(z * (w - 1.f)); \ @@ -1884,7 +1884,7 @@ static void cover##dir##name##_transition(AVFilterContext *ctx, for (int y = 0; y < height; y++) { \ for (int x = 0; x < width; x++) { \ const int zx = z + x; \ - const int zz = zx % width + width * (zx < 0); \ + const int zz = (zx + width) % width; \ dst[x] = (zx >= 0) && (zx < width) ? xf1[zz] : xf0[x]; \ } \ \ @@ -1916,7 +1916,7 @@ static void cover##dir##name##_transition(AVFilterContext *ctx, \ for (int y = slice_start; y < slice_end; y++) { \ const int zy = z + y; \ - const int zz = zy % height + height * (zy < 0); \ + const int zz = (zy + height) % height; \ const type *xf0 = (const type *)(a->data[p] + y * a->linesize[p]); \ const type *xf1 = (const type *)(b->data[p] + zz * b->linesize[p]); \ \ @@ -1952,7 +1952,7 @@ static void reveal##dir##name##_transition(AVFilterContext *ctx, for (int y = 0; y < height; y++) { \ for (int x = 0; x < width; x++) { \ const int zx = z + x; \ - const int zz = zx % width + width * (zx < 0); \ + const int zz = (zx + width) % width; \ dst[x] = (zx >= 0) && (zx < width) ? xf1[x] : xf0[zz]; \ } \ \ @@ -1984,7 +1984,7 @@ static void reveal##dir##name##_transition(AVFilterContext *ctx, \ for (int y = slice_start; y < slice_end; y++) { \ const int zy = z + y; \ - const int zz = zy % height + height * (zy < 0); \ + const int zz = (zy + height) % height; \ const type *xf0 = (const type *)(a->data[p] + zz * a->linesize[p]); \ const type *xf1 = (const type *)(b->data[p] + y * b->linesize[p]); \ \ -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]